Daily AI brief · October 10, 2026
AI Agent Tools Helped Breach 7 Korean Financial Firms
CrowdStrike traced a string of South Korean bank breaches to one attacker using an open-source AI hacking agent, Claude's Docs and Slides reached every plan including Free, and Anthropic rewrote its usage rules.
An AI hacking agent helped one attacker breach seven South Korean financial firms (CrowdStrike, The Next Web, ThePrint) CrowdStrike published a report on Wednesday tracing a run of breaches at South Korean financial institutions, from late September into early October, to a single financially motivated attacker who is probably a 26-year-old based in Guangdong, China. Breaches were reported at Shinhan, KB Kookmin, Hana and BNK Busan banks, two savings banks and Hyundai Capital, exposing records on 66,000 to 68,000 people, depending on the count, and about 2,200 businesses. The attacker leaned on ARTEX, a Chinese open-source AI agent built for legitimate penetration testing, together with several commercial AI models, including Anthropic's Claude Code, to speed up each step of the intrusions. For a small business, the uncomfortable part is the math: if one person with an AI helper can work through seven banks in a couple of weeks, the cost of probing a 20-person company with an old VPN and a reused password is now close to nothing, so the basics you have been meaning to finish are worth more than they were a month ago.
Claude's Docs, Slides and Design now work on every plan, including Free (Anthropic, TestingCatalog, The New Stack) Anthropic took Docs, Slides and Design out of beta on Thursday and made them available on every Claude plan, Free included. It also opened two new features in beta: Claude Dashboards, which turns a plain-language question into a live dashboard that keeps itself current from a company data warehouse such as BigQuery, Snowflake or Databricks, and is available on paid plans, and Claude Motion, which turns text and charts into a short animated video you can export as an MP4, limited to Team and Enterprise. If you run the office, expect proposals and slide decks made in Claude to start showing up whether or not you bought it, and decide now whether that work belongs in a company account you control or in someone's personal free login.
Anthropic rewrites its usage rules, effective November 12 (Anthropic, MacRumors) Anthropic published its annual update to the rules for using Claude on Thursday, and the new version takes effect November 12. It bans tracking people without their consent, stops Claude from deciding or recommending whom police should investigate or arrest, names more specific weapons uses it won't support, and narrows the election section to deceiving voters rather than all personalized campaign targeting. It also clarifies requirements for high-risk uses, adds safety requirements for machines that act on their own, and, in the line that got the headlines, bans "sustained and needless" cruelty toward Claude, which Anthropic says excludes ordinary frustration, dark fiction and research. Whoever handles AI for you should skim the policy once, because if your business builds anything on Claude, these are the rules your use has to fit, and a vendor's terms are part of your own compliance picture.
Close the easy doors. Give your AI champion or your IT partner one hour to check three things: every remote-access tool and firewall is on its latest update, every account that can reach email or files uses two-step sign-in, and no shared or former-employee password is still active. That is the list an automated attacker works through first.
Pick one account for company documents. Now that Claude can make finished documents and decks on a free plan, add one line to your staff AI rules: "Company documents, decks and customer material are made only in company AI accounts, never personal ones." It keeps your files where you can find them and recover them when someone leaves.
Be wary of AI dashboards on top of messy data. Claude Dashboards and tools like it look impressive in a demo, but a live chart built on a spreadsheet nobody trusts just spreads the wrong number faster. If you try one, start with a report you already check by hand every week, and compare the two for a month.
Where it's going: AI is speeding up both sides at once, the attacker probing your systems and the employee building your reports, so the businesses that keep their basics tight and their accounts in one place will get the benefit without the bill.
- AI hacking agent and South Korean banks: [CrowdStrike, Oct 7](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/) · [ThePrint, Oct 8](https://theprint.in/world/crowdstrike-says-china-based-suspect-used-ai-tools-in-south-korean-bank-hacks/3064977/) · [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/chinese-hacker-ai-korean-banks/)
- Claude Docs, Slides and Design on every plan: [TestingCatalog, Oct 8](https://testingcatalog.com/claude-launches-dashboards-and-motion-in-beta) · [The New Stack](https://thenewstack.io/claude-dashboards-data-motion/)
- Anthropic's new usage rules: [Anthropic, 2026 usage policy update](https://anthropic.com/news/2026-usage-policy-update)
- [Korea JoongAng Daily, on the counts](https://www.koreajoongangdaily.com/business/from-banks-to-lenders-suspected-ai-hacks-expose-cracks-in-koreas-financial-defenses/12904281)
Corrected Oct 10: the number of people affected was given as about 66,000; reported counts range from 66,000 to 68,000.